home

camstudio.exe

Path Quality (Alpha Criteria Ltd.)

The application camstudio.exe by Path Quality (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.giftcapitalbyte.com and multiple other hosts.
Publisher:
CamStudio  (signed by Path Quality (Alpha Criteria Ltd.))

Product:
CamStudio

Version:
2.0.5.a0.1_61161

MD5:
962e3c2086999b82b16e6168e589c505

SHA-1:
aaa279b99595b7ecbea75ed3197ec406a7cf6db7

SHA-256:
84ddc8726cbd00b0c9ce646c87a3616499c5eb8491ab04a9a78a98f0cec959a7

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/1/2024 8:30:52 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC (M)
16.7.20.12

File size:
988.6 KB (1,012,368 bytes)

Product version:
2.0.5.a0.1_61161

Copyright:
CamStudio

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\camstudio.exe

Digital Signature
Signed by:
Path Quality (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 6:09:15 PM

Valid to:
8/3/2016 8:53:56 PM

Subject:
CN=Path Quality (Alpha Criteria Ltd.), O=Path Quality (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121865442A968BACB1F4EC1956476A3AE8D

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:eTfX+OUopkvQikg+G0uJpX8rv6Wa3BmVTf/XvQyMBTlP0QjcpMXVJoa:eD1pkvqkKCWaYzGpfL

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file camstudio.exe has been seen being distributed by the following 50 URLs.

http://www.giftcapitalbyte.com/c?x=7zlRihYMHhgTTYzs341g2gcJrkoePaRrgk51Sn1bsJA=&e=0&c=mvQB8A9EnZ90 zH5wg4LjGR A2fHx44f0xH4JZl1YUvqv5g67zh1dnVu1 GDcOmgvmzkytW 5yYn6QjhHgxVfIh3iAhpjyHk1mgyvc5y3qGyu8 mbgWhZV2L4mGlplQr/OG4Lcm1H/L36AYRZD1C3SPwpjHIiTrpHhftCaJthsg=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=HzS5E1obl9fR0bUOlcaZS qULZNfzd5jqSsk1e R11k=&e=0&c=DsO77t8fYuu6X1hwCQFqCdQ9ZSgBnR3jLXZv7Mxpc3gjwRaeqK02m6wokYgs7xpmgCZfj/GmMpBdG6uZo7kB1hhwQ3kjEWAS9h8sSB0gWAj4aJAR5OhrX0IqeWrl8H5m9QOcXAYGzoS opsi/67IVQJRD1JL3EMRvzswfMwdA70=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/uUuozODKq8v6aLCB79TzWu3s42tNri_7ECFegRN9tEMq L8E7hkaJ4v_ZYnsQBa3Nlz6Hrh AYfGOQcMdUQEk4 0OEubAvmRXspoMUtyBNzULsqfDXbgQaMLDV27Bcn7nyqAYLhlThDVwGe1UNRm3cjKUGQiv01mIqAYsUvTAO05ZcqHbKSubM_a7SenClpXWguVatPF-GzAAAMRtbD7PaUzHinBGEQXBRA4cWkRd6E1tHcgbYzSEZ7dGXVqZJ lTew29AA==

http://www.giftcapitalbyte.com/c?x=xsFS7J jaqBL0IK2SyFZMkIeT pyYHLl4d0CjUmP9z0=&e=0&c=Q3CzmT9Sm5GGeZsrHWgMRSXRDImbmbcWaXG1XVOoSNOV36BsL4BZdhv3PDgtPblJww9k7coEFJaEsb8N0C9ednwGFUNm2 kM2mx3e5ahBQpCgWboM58y REVZX9OsyzrF7t8lcH3RZghAwKrjoi LRjQ/YYTbdguKQS/32i0Mwg=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=kvXc71Lm/214Fc2o1sOaC/C/19PFXbK1jb PBtbuUoQ=&e=0&c=DSp7 JPIPgoKBjIB9gwVIJijLRHoHCaC6d4SujDgJ2Zt6SCgroPcRU/ONG3zkGGbjHSLn9cocHlKUyDE8u6gfxWJTIT66skJkgqaEEbqOXVn6EeLrLtryUdpCz1JKU/vEPK6BLLK4iT/lIz6BYS5PuQv2hDPeNavTlirofCMGuE=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=VtRlVuJkJPsVVChKlEyldCLMu8J8jKGliKVemrV01mA=&e=0&c=8vIq/ReJRiGLYshJG1jVFo4 QJkDC1W EaCwKSgY F0sgCQlEh/dXE91uH0y87QHagfXntU6ro HcwaWLhFNvIVRmjBGeYeI0QNw59dMZeCn8AQLfAT8DcmxmHiagiB1t5C/8HGacGNOGRmF8hrTvWSlctdH0 Mkf637vS xhW4=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=jPLwLve4ralkOSaPJp1ESv1VtjnxAySat14eiRJM2vI=&e=0&c=e0Jlwe0f4M9VjpvwqAIqNXILmCkw04OH2XO0in9Xj6J09UPYAslnMtkEU6GHHGtBfUkLAycQVKZ2Wz6t6hcazZ6vXWmtjGjylT63HVVXRnlVWqB8daNds1XZJGdHceSo77dGUrCNtiSsRZL plTDn2BgInEg/iLBiN3kR8ECvEU=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=bBKa tA1knEMopd4nmFkLwfeTtgY83H2WPhvgp3P2qM=&e=0&c=xLl 43IPP wAKRToHuHEvdTFD1jg2BWELk6bk6cLRO/36aO47ycywY7WUAQ7kpFW 7doyaXhTZoz6S usq/j5Ue5hC9GfeUopbl3AjkCb3ba1cQ/3Itgpei4IgwFRtlzsyiOq/F0COlH5jkGIiX67ILyNDtNVBtYYn/MNaJdRa8=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=a6/goPBDgLcgRQ/GB6pPFPtWDxRMyzco4/QdWyF r2s=&e=0&c=74aFL24LGCi5PZs5hKGQ412Sd Mi5SHMb2NtbvTTTI4cxmXno9HaERtqis08tk2KdA1ZQc uQp/JrGwXwyY42Q4ee0mizNHUdTUC6mo9m1XK127To8UX zjXxs2OACWBRyCvMDba1F 23Oht9oDzKC7rvGW3WsT9RdSQDuf/b/g=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=j2nBPTVo60rgoJkR6AwWfFj35M9b8KpHVl/QltAVLjw=&e=0&c=qgkXs2VqolGPOc0fPLA4zpihbTNahKOmXAfkn eQujvMyKrxd5wRU7sum43jm5HWW1kFMvgU1MTZbSMi4JJ9kt3PRFCLK3SWJe2pu8/wwuqikp9DzUSv8z 0s4TqH7E3u6Xd1tWSA1zgjoxcluJYR28NFx596YT/Zeq/uFIp54=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=m 373VfefOGj5WmgMjvMaxCXsuRBBuKf00Li4f5CEko=&e=0&c=J2V2 ukvoeahLnh50mCaHXdFaiEwCG9p9tAaoPPf/vUn0nKoOJP2ATqVEtPbd6qB5tVgzl63pomDpyMgBNgu91TEDxmIUS9hZzuNoRLALK7lJOzaPJ uFWB6usfIEMXXjbXL0f1WDXz0CDeatOBu1WGkYx0gTX7uBIFG ALq8iI=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=32SNljxxTGW2bhoDXELMFqcO18NOxj16fxWiseUyPrk=&e=0&c=EV11OPNKTiyJjxPMKJaZ4AkDFrDLAmjqwBiTzxm6QzP8aMlLft4iKVhTHDmU0lxD3PBM1NuNq9W6v8lOb6FsCi3YHjGSe9Zmrdk5Cu6NCqkLdjjmqnJ/H5BmjcVVN9aahogv/hOTwKZ9fuylwj/Dsjju/GlDWTcAeYbv36/MEt8=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=MSLL2zUknRghloKsIQOung72MadjmEtwSX6jWY/NNh0=&e=0&c=4/oJ 93ttVUubUPFdRb55VvKvabjRa31vaN8H6B98K3Z3lS5Db5/aR7779/DHvUjFkYW/F9Sd8o0fRZ66Qf6qw yAQe3DCJGRbE5zXFdX66GEgujdtuC83idvmsz9a 8eD8k4 gepD2oUYgvCcVP6WYg3NM7l7yn340jf6A3h3M=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=zN/Ekd2Vf4SW0vYSU0KMD0uxUzV4Vz5vB4hehT8CZqE=&e=0&c=ozbfAc4gmIsCqsdS9i0HnGQRidEI/ABb/bzn5Hsm0x0wFdATVJtLDA/mQ1s1m6aTlnckmgwrI8FiUTsrsAjUnxzZk2HIek/tIWlvbx5CNEV5FC/hU7AUafKLW/HPKN0YO8oqBjE5y9JjPbTbl IQ7wqjvm1ovXU0yEel5C3RbFk=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=ODPsj3AasCkUleAUTF4GbXNf/Glc5Aqr1/xf7EZyWtk=&e=0&c=oZiLq0njCKGhydxfuteAZhMsv6nMNZ xzmMUt0glR0HvslAfbgaSDl0DTYFOekGm1hhqMB7BlfDgzMCwS3BQcdFg1aaEjRFMi4WZd9Pz0NXIwZmMhcta4k0or1UHPxndzLhmprf8pVUrHhVv2dWmQO5DY6wWnNX1sopWFx8f/RQ=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=L2tWu C7CoO08srxQqnYICZF YJPhh8BhjS14bBDmck=&e=0&c=2hw4Jks7eNfTxX0EvPEhFuiU3qB9kNixc9sSUtz/XPO2X6ksD2QMw8U3jzooRHfVVwzaEgwcplwLL1GAlIBD4RoVqjBVDC oPhHs88zETXwJU0JOcafrKpOBKnsBb1/sq4bnpkfMi18eEcJ8ex8etK7/ay7Sb5GlJoMTOPC9ZWE=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=v5XR7uEYY7SA6ieLw6JMViSalcTzv KR9 BH94rb KQ=&e=0&c=1L2Au61f5zYY3JF2/saVrxCB/sv49ieSbmVATHGbwijpr5fyzRsFB/Wbt7BvtakBdmWPB6Q0KBidKbfANc8D4cJFGnEioOOmt7mDCXCfu9TcGCbIqD D2c/B2lUQOwQngJfhF2vwOjMBzLMcorUINsP2yXdUu8nntl3TR5e/6vw=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=MYncUyDLKWJvMoIpPBY5k0i7ZuVaWmF0 oRT3GeImbA=&e=0&c=dKz4g86Q vaOPJ6S9N0P3cEp65bt0dO8HxT6d TNPrhBZSQlcLv/ LYWJJFSifexZ3Fb lTIgqn6Fc/dAE5Q1E82t/hcjVgHxUMtJkXtnBJc7g11K8y0xbWw52nQIdQvoEPfQNfiQjbaRh6L ujeKC3rmicgCiQJK88ELR1OwBw=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=mJzzJM7T2cp csV0GMqdn8He6aaskfaedeGkadzdF88=&e=0&c=C VZSv9Ul2jWAakAbI8gmOe/DGnKdppv6hFpDG9g4zBA9EwBa6HFvX5uNJjRZnh6SqPsqY5juaAkgvvpN1megaisDie7yQ/5h61pNiG9ZtUkqOaibnGpyuICh4ehKFFTz3bpqJ7FDMGD4nOEhSWd t2PQn/Ge3YjLzXSk9Pj eY=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=RIbnldtaQfszvJjGfDTDRD4WJK7LjPW6Yw2e9aUcLoU=&e=0&c=UdyQInx6Ptu63wN8CfVG6BoR0lFqVDEJ3oKHHIdUuj c2lrwyYx3NnhQBRBj6UGYG2bqnSJMV47tfkSAniXV3zvvvgZr0IvcJ1UeR1b0NxM0m8HibDp8by81fngj61LWCzBnTtKz3oRCGxBDYCeVmTkpREL wCgjyqbF1KA0VLk=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=VBJO2BL2VsSijiLrhUjE1uGAaPd8MjeG71cDbS JwPE=&e=0&c=GwTKX/4hRU 0p3YhW4SXUxJGZCz nNTe5v4TOCvwVJWaBDQA8JIZYWEO/ Wh3zLc35TMAdCF2Md3n5jI8IpP5oVObneMIl1vUTFQ6i fIJacywVXFlruG9Wzsglg3mZ3yfMd32nEW4yRfmaLoPW K7QRMnr oC9SX4UbBebVaA=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/Wbhj2oKSCeZuKqvf5TIT4g5PfTtPOO0fD3eanwUvGWC0eYeh0yb79c318w9whH5_adAnFLci5ciLRd70Gr8hKBewSK2yYJscxmvK0hHrZnDamfrMN512aRSoTvszN5H8f5Nm19HYu5cN_stWU_bRvBVVe5JzvCdNWVZnEOUDsOWC_Cvre3JY5Gu JrOUF9Bl9FKbRj5V-GzAAAMRtbD7PaUzHinBGEQXBRA4cWkRd6E1tHcgbYzSEZ7dGXVqZJ lTew29AA==

http://www.giftcapitalbyte.com/c?x=SlJ9iVIZ/ffCPBOioI4WydTtZ8q3PTIEmiMhn riJh0=&e=0&c=huN/LHBO7UbG8KD3SM04zgtODdocGwCG8u/h/c10CKqgu00svNoBdNucW34dIM/p/kK2AvM6bXou5ZIfZYSjmBBLuYafWQT/d7WU2hwUa94OebNhvmiy6mtzBBBAMdjKgVirPUHRjH94juHXvGA1YgnXiHOueaLUUnI/DsRQraI=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=NOdETPyEFRKZykGv/vzDfKjoQtzlyEfavPZzJ8nwBy0=&e=0&c=mJU67RMMdXx0qSLJUll69RAAIx06N/FKgVtDe6sIDiAu1nJ3AaBqyGz3JlkFg 05J kcsicrI2cAozfYeG1kty7Oamzu3Edk3sCIFQV8w42y4lSz8SP0hU6nb8O5DdXTy93m2vOasqHH78DvvO X18mG3 XyBoJItJxz4aGTzz0=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=yETKyF8WUdTbSwfY6 91KNqEWWSIwLKgtCWMgWSGvVw=&e=0&c=GEd81NQ8mTMSMdEiWokAnhayfUFbVQPLEGtoZIjrPCfM9kPHIRiQMyvtLfNgaxWRuhTI0seOCoM8wiHalr3zlN09Qmfmb9qSj2x4HhB8YDKk7ZLOagslCSeeYZ1blfJTNHZpYOGh5x9sP7Hoy8WRHVAOF0s4tSz4hT4UCxnT87M=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=YbUwp6P gTDv8nIqT3Cl7kynTwOLNw8LVKYPie9rAUQ=&e=0&c=igDK4azcl4X3TeZV6OIZ9m097LqliqQP7hZUWJaEUxtSdsULA3biadBZKp2vtikWQL8mAq BfS84CarP08AoTZL 0Zv0s012aV49TkOk/AzkJ481c9k5nh3J3xNJ0uRwZhwIFm7w0 1z6jP1OpS LkzsrKZ4Mn3SzNFhrQdKf8k=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=H3hitGrEMcBOZ7e3l1pGvHwauxnzmAlJH6ntm3QPB0k=&e=0&c=axl6ulVplqH4h6OFZO/XXBSpzlE7ycU chCCq4Hra931k6x1Sn1RpFz/uXrnzOPTqVqHSFcAcNEYO6tFM9hANBHwkqa dRuxgJDL7hy/Zcxv5qxsptZyoK7PXxwLPeYiK8l9NgpEuS0qEtrERkNeI8vFqEVJMZeEesNKUHvyjBo=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=g5/LJFtb5VZR2TofFiKAC3rSokz5hkt93D6q0mU WrU=&e=0&c=jJDQdsZXWr UZo8LKkxHz5QEKc1i OaC4OlOVShtfiLHiujSByl8Xd5h8IsKquZWPJ5EvoPmyKE9AASp31QDGj0RH0bQUetIprp4X64PXOyxXZ2zcrzQVOXr05HBtLmdjBrZtJv46XYgVUVD49fPbleZXKQHN3kqBwUwkcS3yRE=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=u3wxY2q5XlW3aoSxb6 Me/Kvw 07Lo7WMFU1yJApiNc=&e=0&c=J5iJbXL8Q2q0/j/yQUP83fKQIewfP5Ywtz1xlUCCfhzQUQ/tLOSXl6xM7iUjsSfUry1RNlq2lWF9KiXLzA8cuZWZaNF6/Oe12kkZXUSSLTK4kmnkTeHWm3BXowyuHQJTBjiFn9RXAFU0WgIQsO45Wek08fvpG4Fs1c2xogQmfkI=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

http://www.giftcapitalbyte.com/c?x=OdtH7XgeDBu6ePgNw7e942lJkmhaEx0wJCw v038ZnY=&e=0&c= dWR1e8pu w2pi7PuYPXflsnvUYDhq8Vd7aco40Jy7qFUJRr2mN 5wFpr76hKuMMroVfX5GXAXyjGFArjBvAiW oeGOQvWLfxBcdUd lzsMfMRJCCgkk70ZIklzh0 zyazBs28GQCS8LHIk oG7UP17NREjftPmtbDHt1TQeUG0=&downloadAs=camstudio.exe&fallback_url=http://.../CamStudioSetup.exe

Latest 30 of 63 download URLs

Remove camstudio.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.